Malware-as-a-Service (MaaS) is a criminal business model in which developers rent or sell ready-to-use malware, infrastructure and support to other criminals, usually for a subscription fee.
How Malware-as-a-Service works
MaaS copies the software-as-a-service model of legitimate companies. A developer builds and maintains the malware, then sells access on underground forums and Telegram channels. Customers typically receive:
- a builder to generate fresh, uniquely packed samples;
- a web panel to manage infected machines and download stolen data;
- hosting for command servers, often on bulletproof hosting;
- updates to evade antivirus, documentation and customer support.
Pricing ranges from monthly subscriptions to lifetime licences. Ransomware as a Service is a related model in which affiliates share profits with the developers instead of paying a fixed fee.
Why MaaS matters
MaaS lowers the entry barrier: criminals with no programming skills can run sophisticated campaigns. The most popular offerings are infostealers such as RedLine and Lumma, loaders, remote access trojans and Android banking malware. Stolen credentials from these campaigns are resold and frequently lead to ransomware and data breaches. Law enforcement increasingly targets the services themselves: Operation Magnus disrupted RedLine and META in 2024, and in 2025 Microsoft and international partners seized thousands of domains used by Lumma.
How to defend against MaaS threats
- Use EDR and keep detections current, since MaaS customers continually repack samples.
- Prevent credential theft: avoid saving passwords in browsers on work devices and enforce MFA.
- Educate users about fake software downloads, cracked programs and malicious ads, the main distribution channels.
- Monitor for leaked credentials and session tokens and revoke them quickly.
